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GAD 


United  States 

General  Accounting  Office 

Washington,  D.C.  20548 


National  Security  and 
International  Affairs  Division 

B-277464 


July  21, 1997 

The  Honorable  Ike  Skelton 
House  of  Representatives 

The  Honorable  John  Glenn 
Ranking  Minority  Member 
Committee  on  Governmental  Affairs 
United  States  Senate 

As  you  requested,  we  have  reviewed  the  Department  of  Defense’s  (dod) 
efforts  to  protect  U.S.  forces  from  terrorist  attacks.  This  report  addresses 
(1)  measures  taken  at  overseas  U.S.  bases  to  enhance  the  security  of 
deployed  personnel  and  (2)  recent  dod  initiatives  to  improve  its 
antiterrorism^  program.  We  plan  to  issue  a  separate  report  on  national 
coimterterrorism  policy  and  strategy;  the  roles,  responsibilities,  programs, 
and  activities  of  federal  agencies  imder  this  policy;  and  the  mechanisms 
for  coordinating  interagency  efforts. 


^SBtoved  im  gablaa  isi®Qa3  : 


Background 


In  November  1995,  a  car  bomb  exploded  in  Riyadh,  Saudi  Arabia,  killing 
five  Americans  who  were  working  at  the  Office  of  the  Program  Manager, 
Saudi  Arabian  National  Guard.  A  few  months  later,  in  June  1996,  another 
terrorist  bomb  detonated  near  Dhahran,  Saudi  Arabia.  The  explosion  killed 
19  U.S.  service  personnel  living  in  a  high-rise  apartment  building  at  the 
Khobar  Towers  military  complex.  Hundreds  more  were  injured.  Soon  after 
the  Khobar  Towers  bombing,  the  Secretary  of  Defense  appointed  a  task 
force  headed  by  retired  four-star  Army  General  Wayne  A.  Downing  to 
investigate  the  incident  and  make  recommendations  on  how  to  prevent  or 
minimize  the  damage  of  future  attacks.  The  Downing  Assessment  Task 
Force  completed  its  work  in  August  1996.  The  Secretary  of  Defense  on  the 
whole  concurred  with  the  task  force’s  report  and  announced  a  series  of 
measures  intended  to  improve  the  protection  of  deployed  U.S.  forces.  He 
said  that  the  threat  of  sophisticated,  organized  terrorism  against  our 
overseas  forces  was  now  a  fact  of  life  and  that  U.S.  leaders  must  adopt  a 
“radically  new  mind-set”  with  regard  to  international  terrorism.  In  early 
1997,  the  Chairman  of  the  Joint  Chiefs  of  Staff  provided  a  status  report  to 


^For  the  purposes  of  this  report,  we  are  using  the  DOD  term  “antiterrorism”  to  refer  to  defensive 
measures  used  to  reduce  the  vulnerability  of  individuals  and  property  to  terrorist  acts. 
Counterterrorism,  in  contrast,  refers  to  offensive  measures  taken  to  prevent,  deter,  and  respond  to 
terrorism.  Antiterrorism  and  counterterrorism  are  elements  of  a  broader  concept  known  as  combating 
terrorism.  In  turn,  combating  terrorism  is  part  of  a  much  broader  concept  known  as  force  protection. 
Other  elements  of  force  protection  are  physical  security,  operations  security,  protective  services,  and 
law  enforcement  operations. 
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Congress  on  dod’s  response  to  the  Downing  task  force.  The  Chairman 
stated  DOD  was  implementing  all  of  the  task  force’s  recommendations.^ 

The  task  force  found  that  dod  lacked  a  comprehensive,  consistent 
approach  to  antiterrorism  that  is  based  on  common  guidance,  standards, 
and  procedures.  A  top  priority,  it  said,  should  be  designating  a  single 
element  in  dod  to  oversee  an  integrated  system  approach  to  force 
protection  efforts,  manage  resources,  and  assist  commanders  in  the  field. 
At  that  time,  dod  lacked  a  single  entity  with  responsibility  for  the  program, 
and  the  task  force  stated  this  had  an  adverse  impact  on  the  posture  of 
forces  in  the  field.  The  task  force  noted  that  policies,  standards,  and 
available  resources  all  varied  significantly  among  both  service  and  joint 
forces.  The  Downing  task  force  identified  key  principles  for  managing  and 
improving  the  Department’s  antiterrorism  program.  We  used  these  as  the 
primary  criteria  for  our  review. 

DOD  does  not  know  how  much  is  being  spent  on  antiterrorism  because  it 
cannot  easily  determine  what  costs  are  associated  with  its  antiterrorism 
program,  dod  has  estimated  that  it  spends  about  $4  biltion  a  year  on 
combating  terrorism — ^the  term  dod  uses  when  discussing  both 
antiterrorism  and  coimterterrorism — ^but  this  figure  includes  broad  cost 
elements  such  as  physical  security,  counterintelligence,  security  and 
investigative  matters,  and  coimterterrorism.®  In  addition,  certain  costs 
related  to  antiterrorism  are  not  captured  in  the  $4  billion  estimate.  In 
particular,  the  estimate  does  not  include  funds  being  spent  by  base 
commanders  from  their  base  operations  accounts — ^the  money  they  use  to 
finance  the  day-to-day  operations  of  their  activities.  Also  not  included  in 
this  estimate  is  the  cost  of  dual-use  items  such  as  ballistic  body  armor  or 
armored  vehicles  that  can  be  used  in  support  of  a  unit’s  primary  mission  or 
to  defend  and  protect  against  a  terrorist  attack. 

DOD  designates  the  terrorist  threat  level  faced  by  personnel  in  each 
country.  A  five-step  scale  is  used  to  describe  the  severity  of  threat.  'These 
steps,  firom  highest  to  lowest,  are  critical,  high,  medium,  low,  and 
negligible.  'Threat  levels  may  be  raised  or  lowered  based  on  new 
information  or  analysis.  In  May  1997,  dod  had  designated  13  countries  as 
having  a  high  threat  level  and  1 — ^Lebanon — as  having  a  critical  threat  level 
(see  fig.  1). 


“As  of  June  3, 1997,  DOD  said  all  but  2  of  the  task  force’s  81  recommendations  had  been  implemented. 
Implementation  of  the  two  remaining  recommendations  was  delayed  by  procurement  problems. 

^About  90  percent  of  the  costs  in  DOD’s  $4  billion  estimate  are  for  civilian  and  miUtary  personnel  such 
as  contract  guards  and  military  police. 
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Figure  1:  Countries  Where  the  Terrorist  Threat  Is  Critical  or  High  (as  of  May  15,  1997) 


Source:  Defense  Intelligence  Agency. 


Results  in  Brief 


Many  deployed  U.S.  forces  are  better  protected  today  from  terrorist 
attacks  similar  to  the  one  that  occurred  at  Khobar  Towers.  During  March 
and  April  1997,  we  visited  30  overseas  sites  and  formd  that  security 
improvements  were  most  evident  where  the  risk  of  terrorism  is  the 
greatest,  such  as  Turkey  and  the  Middle  East,  dod  has  placed  less 
emphasis  on  addressing  vulnerabilities  in  countries  that  are  currently 
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considered  to  have  a  lower  threat.  Senior  military  commanders  and 
defense  officials  we  met  with  emphasized  that  they  can  reduce,  but  not 
eliminate,  vulnerabilities  and  that  further  terrorist  attacks  against 
U.S.  forces  should  be  expected.  They  also  observed  that  efforts  to  defend 
against  terrorism  are  complicated  by  a  number  of  factors,  including  the 
ability  of  terrorists  to  decide  where  and  when  to  attack  and  to  choose 
from  a  wide  selection  of  targets.  Nevertheless,  the  officials  said,  some  risk 
must  be  accepted  as  the  United  States  prrrsues  its  national  security 
strategy  abroad. 

Since  the  bombing  at  Khobar  Towers,  dod  has  initiated  a  number  of 
changes  aimed  at  improving  its  antiterrorism  program.  For  example,  dod 
has  established  a  new  office  for  combating  terrorism  on  the  Joint  Staff, 
enhanced  the  antiterrorism  responsibilities  of  the  geographic  combatant 
commands,  and  instituted  a  vulnerability  assessment  process  under  the 
aegis  of  the  Joint  Staff.  These  initiatives,  however,  have  not  resulted  in  a 
comprehensive,  consistent  approach  to  antiterrorism  as  called  for  by  the 
Downing  task  force.  For  instance,  dod’s  force  protection  focal  point  has 
not  provided  the  geographic  combatant  commanders  the  guidance  the 
cortunanders  believe  they  need  to  carry  out  their  expanded  antiterrorism 
responsibilities.  Such  guidance  would  include  establishing  standards  for 
assessing  vulnerabilities  and  agencywide  physical  security  requirements 
designed  to  provide  a  minimum  level  of  protection  to  U.S.  forces  no  matter 
where  they  are  located.  A  comprehensive,  consistent  approach  to 
antiterrorism  using  common  standards  would  give  commanders  a  more 
objective  basis  for  determining  whether  they  are  providing  adequate 
protection  to  their  facilities  and  personnel.  Further,  dod  would  have  a 
capability  to  compare  vulnerabilities  at  different  sites  on  a  worldwide 
basis  and  thus  ensure  that  sufficient  emphasis  is  being  placed  on  the  most 
vulnerable  areas. 


Protection  of  Many 
U.S.  Forces  Has 
Improved,  but 
Vulnerabilities  Remain 


During  our  visits  to  overseas  bases,  we  found  significant  security 
improvements  have  been  made  in  Turkey  and  the  Middle  East  to  protect 
against  vehicle  bombs.  In  these  countries,  sites  have  been  fortified  in 
various  ways  against  a  terrorist  attack,  particularly  against  a  truck  bomb 
similar  to  the  one  that  struck  Khobar  Towers.  Commanders  have 
attempted  to  extend  the  stand-ofU  distance  around  their  facilities,  and 
where  sufficient  stand-off  cannot  be  obtained,  they  are  using  other 
measures  to  mitigate  against  the  impact  of  a  truck  bomb. 


“'According  to  DOD  officials,  stand-off  is  the  distance  between  the  base  facilities  and  uncontrolled 
public  and  private  land. 
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Saudi  Arabia  has  seen  the  most  profound  changes,  as  thousands  of  dod 
personnel  have  been  moved  to  remote  facilities  in  the  desert  and  restricted 
from  leaving  base  throughout  their  entire  tour.  Most  military  dependents 
have  been  sent  back  to  the  United  States  to  reduce  their  exposure  to  the 
terrorist  threat.  Many  dependents  are  also  being  withdrawn  from  Kuwait 
and  Bahrain.  In  Turkey,  an  off-base  apartment  building  dedicated  solely  to 
U.S.  military  personnel  was  closed  because  it  was  considered  too 
vulnerable  to  a  truck  bomb  attack.  The  personnel  living  in  this  building 
were  relocated  to  on-base  housing  or  dispersed  to  other  off-base  housing 
facilities.  The  base  also  had  installed  concrete  barriers  to  make  on-base 
residential  areas  and  headquarters  buildings  less  vulnerable  and  had  begim 
to  repair  holes  in  the  perimeter  fence. 

DOD  has  placed  less  emphasis  on  improving  security  at  sites  where  the 
terrorist  threat  is  not  considered  to  be  high.  Base  officials  at  many  of  the 
installations  we  visited  identified  numerous  vulnerabilities  that  were  still 
to  be  addressed.  For  instance,  stand-off  distance  around  base  facilities, 
including  housing,  was  often  a  few  feet  or  less.  Facilities  were  frequently 
located  in  populated  areas,  abutting  public  roads  and  privately  owned 
land,  offices,  or  residences.  Base  officials  said  it  would  be  very  difficult  to 
defend  these  facilities  against  a  truck  bomb  attack  like  the  one  at  Khobar 
Towers.  However,  they  said  it  was  impractical  to  obtain  sufficient 
stand-off  distance  either  due  to  shortages  of  suitable  land  or  the  high  cost 
of  obtaining  it. 

During  our  visits,  military  officials  told  us  that  the  question  is  not  whether 
additional  terrorist  attacks  will  occur,  but  when,  where,  and  how.  In  this 
light,  they  emphasized  that  while  vulnerabilities  to  attacks  can  be  reduced, 
a  “zero  defects”  approach  to  fighting  terrorism  is  not  possible,  dod  faces  a 
number  of  obstacles  in  defending  against  future  terrorist  attacks.  First, 

DOD  has  a  large  presence  in  many  countries  around  the  world,  offering  a 
plethora  of  potential  targets,  dod  does  not  have  the  resources  to  fully 
protect  all  of  them  all  the  time.  Second,  predictive  intelligence  on  terrorist 
attacks  is  difficult  to  obtain.  Commanders,  therefore,  may  not  be  in  a 
position  to  prevent  an  attack  from  occurring;  they  can  only  prepare  to 
minimize  the  consequences  from  an  attack.  Third,  dod  installations  are 
often  located  on  host  nation  installations  and,  as  a  result,  there  are 
hmitations  on  the  security  measures  dod  can  imdertake.  Pohtical  and 
cultural  considerations  outside  the  control  of  local  commanders  may 
influence  decisions  that  affect  security. 


DnC  QTTALITr  INSPECTED  4 
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According  to  dod  officials,  terrorism  is  a  pervasive  phenomenon,  whose 
specific  threats  are  difficult  to  predict.  It  is  worldwide  in  scope,  with  some 
terrorist  organizations  state  supported  and  some  only  loosely  affiliated,  in 
support  of  multiple  causes.  It  is  a  transnational  phenomenon,  cutting 
across  geographic  and  political  boundaries.  Areas  considered  safe  and 
benign  one  day,  such  as  Saudi  Arabia  prior  to  the  bombings,  can  quickly 
become  high  threat  the  next.  According  to  these  officials,  terrorism’s  tactic 
is  not  to  challenge  U.S.  military  power  directly,  but  to  weaken  U.S.  resolve 
through  indirect  attacks  on  weak  links  with  high  publicity  value. 

In  a  September  1996  report  to  the  President,  the  Secretary  of  Defense  said 
executing  the  national  security  strategy  to  protect  U.S.  interests  requires 
the  physical  presence  of  U.S.  forces  in  many  nations,  presenting  constant 
exposure  to  the  threat.  U.S.  conunanders  in  the  past  have  accepted 
operating  locations  that  present  serious  security  challenges  in  today’s 
terrorist  environment.  The  location  of  Khobar  Towers,  for  example,  was 
difficult  to  defend,  but  the  complex  was  paid  for  by  the  Saudis  and 
convenient  to  U.S.  military  work  areas.  In  most  of  the  countries  we  visited, 
we  foimd  that  many  U.S.  forces  are  located  in  urban  areas,  closely 
surrounded  by  easily  accessible  buildings  or  roads. 

In  many  cases  overseas,  U.S.  forces  work  at  facilities  that  are  owned  by 
the  host  nation,  and  they  depend  on  the  host  nation  for  important  security 
functions.  U.S.  forces  in  the  Middle  East  are  prevented  from  patrolling 
outside  their  own  perimeter  fencing.  At  one  location  we  visited  in  Europe, 
entry  to  the  base  is  controlled  by  host  nation  security  forces  with  no  U.S 
military  role.  The  U.S.  military  does  not  have  its  own  perimeter  at  this  base 
and  may  not  approach  the  base  perimeter  without  escort. 

Some  officials  expressed  concern  that  efforts  to  isolate  and  fortify  dod 
facihties  could  make  other  targets  more  vulnerable.  For  instance, 
terrorists  could  decide  to  target  small  military  offices,  housing  areas,  or 
vehicular  traffic  outside  the  main  installations.  In  most  of  the  countries  we 
visited,  many  U.S.  military  personnel  were  living  in  off-base  housing 
complexes  or  in  individual  quarters  dispersed  among  the  civilian 
population.  In  Naples,  Italy,  for  instance,  residences  for  U.S.  personnel 
were  spread  out  over  an  approximately  350  square-mile  area.  At  one  base 
we  visited,  antiterrorism  officials  were  fairly  comfortable  with  the  security 
of  the  base  but  were  concerned  about  a  five-story  housing  complex  for 
unaccompanied  personnel  that  is  located  in  a  residential  area  off  a  heavily 
traveled  street.  This  housing  complex  lacked  basic  physical  security 
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features  such  as  protective  window  coating,  a  central  fire  alarm  system, 
and  adequate  perimeter  fencing. 

In  addition  to  choosing  different  targets,  terrorists  can  also  alter  their 
mode  of  attack.  For  instance,  some  commanders  in  the  Middle  East  are 
concerned  that  terrorists  will  switch  to  weapons  that  can  be  fired  over 
perimeter  defenses  from  hidden  locations.  One  U.S.  commander  was 
concerned  that  terrorists  could  launch  indirect  fire  attacks  from  several 
sectors  of  the  surrounding  city.  Such  attacks  are  difficult  to  defend  against 
because  these  weapons  can  be  set  up,  fired,  and  moved  from  concealed 
areas  very  quickly.  U.S.  security  officials  at  a  base  in  Europe  said  because 
the  host  nation-controlled  base  perimeter  is  easily  penetrated,  they  believe 
themselves  to  be  more  vulnerable  to  suitcase  bombs  than  to  truck  bombs. 


DOD  Has  Taken  Steps 
to  Improve  The 
Antiterrorism 
Program 


DOD  has  initiated  a  number  of  changes  in  the  antiterrorism  program  since 
the  Khobar  Towers  bombing.  Announcing  the  initiatives  in 
September  1996,  the  Secretary  of  Defense  stated  that  their  intended 
aggregate  effect  was  to  (1)  place  antiterrorism  up  front  as  a  major 
consideration  with  other  key  mission  goals,  (2)  ensiure  that  the  threat  and 
antiterrorism  measures  are  constantly  evaluated,  and  (3)  empower 
commanders  with  increased  resources  and  flexibility  to  be  responsive  to 
changes  in  threat. 


Some  of  the  major  initiatives  are  as  follows: 

•  The  Secretary  of  Defense  issued  a  revision  of  dod  Directive  2000.12,  which 
governs  the  Department’s  antiterrorism  program. 

•  The  Secretary  of  Defense  assigned  the  Chairman,  Joint  Chiefs  of  Staff,  to 
be  his  principal  advisor  on  antiterrorism.  To  support  this  added 
responsibility,  the  Chairman  created  a  new  office  in  the  Joint  Staff — ^the 
Deputy  Directorate  for  Combating  Terrorism  (jcs/j-34). 

•  The  Secretary  of  Defense  directed  that  the  five  geographic  combatant 
commanders  take  on  increased  antiterrorism  responsibilities.  The 
commanders  of  the  U.S.  Atlantic  Command,  U.S.  Central  Command, 

U.S.  European  Command,  U.S.  Pacific  Command,  and  U.S.  Southern 
Conunand  are  now  responsible  for  ensuring  the  protection  of  dod 
personnel  in  their  area  of  responsibility.  Prior  to  this,  no  dod  components 
were  explicitly  given  this  responsibility. 

•  Under  the  direction  of  jcs/j-34,  the  Defense  Special  Weapons  Agency  began 
to  conduct  vulnerability  assessments  at  installations.  The  assessments, 
which  supplement  those  done  by  other  dod  components,  are  intended  to 
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help  commanders  understand  their  vulnerabilities  to  terrorist  attack  and 
to  give  them  options  for  enhancing  security  and  mitigating  weapon  effects. 

•  DOD  has  mandated  more  robust  antiterrorism  training  for  personnel 
deploying  to  medium-  and  high-threat  countries.  The  training  is  intended 
to  increase  awareness  of  the  threat  and  provide  information  on  individual 
protective  measures.  Additional  training  is  to  be  provided  to  (1)  personnel 
designated  as  unit  antiterrorism  instructors  and  advisors,  (2)  officers 
attending  precommand  courses,  and  (3)  executive-level  officials  with 
antiterroiism  responsibilities. 

•  The  Secretary  of  Defense  established  a  $14-million  centrally  controlled 
fund  to  support  emergency,  high-priority  antiterrorism  requirements  not 
funded  by  the  services.  The  fund  is  managed  by  jcs/j-34. 

•  The  services  have  also  planned  or  instituted  changes  in  their  approach  to 
antiterroiism.  Most  notably,  the  Air  Force  has  created  a  Force  Protection 
Group  that  will  be  among  the  first  to  deploy  in  a  contingency.  The  group, 
consisting  of  personnel  from  a  variety  of  specialties,  will  be  responsible 
for  establishing  the  security  infrastructure  at  the  deployment  site. 

During  our  visits  overseas,  we  found  evidence  that  commanders  at  all 
levels  were  placing  more  emphasis  on  the  antiterroiism  program  than  they 
had  prior  to  Khobar  Towers.  Since  that  bombing,  most  sites  had  appointed 
an  antiterrorism  focal  point,  established  a  team  to  address  antiterrorism 
issues,  and  conducted  additional  vulnerability  assessments  to  identify 
needed  improvements. 

By  far  the  most  progress  had  been  made  by  the  U.S.  Central  Command  and 
its  service  component  commands.  U.S.  Central  Command’s  area  of 
responsibility  includes  the  Middle  East,  the  region  with  the  most 
high-threat  countries.  The  special  emphasis  at  U.S.  Central  Command  is 
not  unexpected  given  that  its  forces  were  the  most  recent  targets  of 
terrorist  attacks.  Among  other  actions,  the  command  had 

•  determined  the  range  of  specific  terrorist  threats  it  needed  to  counteract 
in  its  area  of  responsibility,  including  a  20,000-pound  truck  bomb; 

•  devised  threat-based  standards,  such  as  stand-off,  to  guide  the  design  and 
construction  of  new  facilities  and  modifications  to  existing  structures; 

•  established  a  forward  activity  that  is  responsible  for  coordinating 
antiterrorism  in  the  region  and  reports  directly  to  the  Deputy 
Commander-in-Chief,  U.S.  Central  Command;  and 

•  identified  a  need  for  hundreds  of  additional  security  personnel  and  filled 
these  slots. 
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DOD  Still  Needs  to 
Develop  a 
Comprehensive, 
Consistent  Approach 
to  Antiterrorism 


The  U.S.  European  Command,  whose  area  of  responsibility  includes  large 
parts  of  Europe,  Africa,  and  the  Middle  Blast,  also  had  made  progress.  Its 
Army  component  was  particularly  active  in  addressing  antiterrorism 
issues.  For  instance,  it  had  updated  its  operations  order  governing 
antiterrorism  at  Army  sites,  conducted  assessments  of  the  antiterrorism 
programs  of  its  subordinate  commands,  and  established  a  senior-level 
working  group  to  make  antiterrorism  funding  decisions. 


dod’s  current  emphasis  on  antiterrorism  was  still  relatively  new  at  the  time 
we  completed  our  review  in  June  1997 — 1  year  after  the  Khobar  Towers 
bombing.  Nevertheless,  oxu"  work  raises  concerns  that  its  initiatives  fall 
short  of  correcting  the  shortcomings  identified  in  the  Downing  task  force 
report  and  of  meeting  the  needs  of  commanders  in  the  field.  The  task  force 
envisioned  a  comprehensive,  consistent  dod  approach  to  combating 
terrorism  spearheaded  by  one  office  that  would  develop  policy  and 
standards,  act  as  an  advocate,  assist  commanders  in  the  field,  and  manage 
resources  on  both  a  routine  and  emergency  basis.  On  the  basis  of  our 
review,  we  believe  dod’s  combating  terrorism  office — jcs/j.34 — has  not 
taken  an  active  enough  role  in  providing  the  antiterrorism  tools 
commanders  are  requesting.  For  instance,  dod  has  not 

•  provided  common  standards  to  assess  vulnerabilities, 

•  promulgated  prescriptive  physical  security  standards  that  would  require  at 
least  a  minimum  level  of  protection  to  U.S.  forces, 

•  ensured  consistency  in  the  security  countermeasures  commands  take  in 
responding  to  threats,  and 

•  clarified  security  responsibilities  for  all  its  personnel  overseas. 

The  Downing  task  force  found  that  in  the  absence  of  definitive  guidance 
from  DOD,  local  commanders  approach  force  protection  based  on  general 
guidance  from  their  service  component  commands  or  on  their  own 
knowledge  and  experience  and  that  of  their  staff.  Based  on  our  site  visits, 
we  found  that,  outside  the  U.S.  Central  Command,  this  was  generally  still 
the  case.  In  our  view,  dod’s  failure  to  impose  a  comprehensive  approach  to 
combating  terrorism,  as  envisioned  by  the  Downing  task  force,  has 
resulted  in  a  program  that  stiU  lacks  consistency  and  coordination. 
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DOD  Needs  a  More  Active 
Antiterrorism  Focal  Point 
to  Provide  the  Guidance 
Commanders  Are 
Requesting 


One  of  the  central  conclusions  of  the  Downing  task  force  was  that  DOD 
needed  a  stronger  centralized  approach  to  antiterrorism.  To  implement 
this  approach,  the  task  force  said,  a  single  dod  entity  should  be  designated 
as  responsible  for  antiterrorism.  This  entity,  among  other  things,  should 
develop  and  issue  physical  security  standards,  inspect  compliance  with 
these  standards,  manage  resources  on  both  a  routine  and  emergency  basis, 
and  assist  field  commanders  with  antiterrorism  matters,  the  task  force 
said.  The  task  force  found  in  its  review  that  the  lack  of  a  single  dod  entity 
responsible  for  antiterrorism  had  had  an  adverse  impact  on  the  posture  of 
forces  in  the  field. 


In  response  to  the  task  force  recommendation,  the  Secretary  of  Defense 
acknowledged  the  need  for  a  more  centralized  focus  and  clearer  lines  of 
responsibiUty  for  establishing,  coordinating,  and  overseeing  force 
protection.  Accordingly,  he  appointed  the  Chairman  of  the  Joint  Chiefs  of 
Staff  as  dod’s  focal  point  for  antiterrorism  and  directed  the  Chairman  to 
establish  an  office  to  carry  out  the  antiterrorism  responsibilities.  This  new 
office,  JCS/j-34,  has  subsequently  become  involved  in  a  wide  variety  of 
antiterrorism  issues. 

JCs/j-34  sees  its  role  as  synchronizing  the  efforts  of  the  Joint  Staff  in 
combating  terrorism,  to  include  assisting  the  combatant  commands  in  the 
execution  of  their  new  antiterrorism  responsibilities,  but  not  to  the  extent 
of  prescribing  policies  and  procedures  to  the  geographic  combatant 
commands  for  carrying  out  their  new  antiterrorism  responsibihties.  In 
addition,  jcs/j-34  has  no  plans  to  develop  and  issue  physical  security 
standards  (discussed  further  later  in  this  report),  nor  does  it  plan  to 
conduct  compliance  inspections  as  recommended  by  the  Downing  task 
force.®  JCs/j-34  officials  said  they  are  precluded  from  exercising  authority 
over  the  antiterrorism  program  because  the  Chairman  is  not  in  the 
geographic  combatant  commanders’  chain  of  command.  These  officials 
said  the  Secretary  of  Defense  is  the  single  dod  entity  with  authority  over 
the  antiterrorism  program.  However,  the  Secretary  of  Defense  directed 
that  the  joint  staff  office  review  standards,  doctrine,  deployments, 
budgets,  audit  plans,  technology  development  programs,  and  aU  other 
aspects  of  force  protection  policy  and  programs  and  recommend  any 
action  needed.  For  example,  jcs/j-34  is  the  principal  author  of  dod’s  new 
combating  terrorism  program  standards  to  be  issued  by  the  Secretary  of 
Defense.  Although  the  new  program  standards  lack  the  detailed  and 
descriptive  criteria  called  for  by  the  Downing  task  force,  they  demonstrate 


®JCs/j-34  and  the  Defense  Special  Weapons  Agency  have  stressed  that  their  new  vulnerability 
assessments  are  not  intended  as  inspections. 
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that  JCs/j-34  has  the  capability  to  develop  prescriptive  standards  for 
issuance  by  the  Secretary  of  Defense. 

Moreover,  on  the  basis  of  our  review,  we  believe  there  is  a  need  for  this 
type  of  guidance.  During  our  visits  to  the  geographic  combatant 
commands  and  their  service  component  commands,  officials  identified  a 
need  for  more  guidance  to  help  them  carry  out  their  expanded  force 
protection  responsibilities.  For  example: 

.  A  senior  official  at  U.S.  Southern  Command  said  that  additional  guidance 
should  be  provided  to  help  commanders  determine  when  sufficient 
antiterrorism  measures  had  been  taken. 

•  Senior  antiterrorism  officials  at  U.S.  European  Command  and  U.S.  Central 
Command  said  they  were  waiting  for  implementation  guidance  from  dod 
on  how  to  fulfill  the  requirement  that  they  identify  and  report 
antiterrorism  deficiencies  in  their  area  of  responsibility. 

•  U.S.  Air  Forces  in  Europe  recommended  that  dod  develop  an  antiterrorism 
“postulated  threat”  to  assist  in  developing  security  measures,  manning 
standards,  and  construction  specifications. 

.  U.S.  Central  Command  requested  that  a  DOD-wide  standard  for  stand-off 
distance  be  developed.  When  dod  declined  to  issue  such  a  standard, 

U.S.  Central  Command  developed  its  own.  However,  there  were  still 
questions  about  the  appropriate  risk  to  accept  from  a  20,000-pound  truck 
bomb.  One  subordinate  command  advocated  doubling  the  stand-off 
distance  standard  to  decrease  the  potential  damage  to  personnel. 


Vulnerability  Assessments 
Differ  in  Frequency, 
Approach,  and  Quality 


Vulnerability  assessments  are  tools  commanders  use  to  evaluate  their 
ability  to  defend  against  terrorist  attack  and  to  highlight  security 
weaknesses  that  terrorists  could  exploit.  Currently,  however,  there  is  not  a 
common  understanding  within  dod  of  how  to  conduct  a  vulnerability 
assessment  or  what  constitutes  a  high-quality  assessment,  dod  and  the 
services  have  prescribed  few  requirements  for  conducting  vulnerability 
assessments.  The  result  is  that  commanders  in  the  field  may  receive  a 
detailed  and  useful  assessment  or  they  may  receive  one  that  is  of  little  to 
no  use.  Furthermore,  in  the  absence  of  standardized  assessments,  dod 
cannot  compare  the  results  from  different  sites  and  determine,  on  a 
worldwide  basis,  how  well  its  forces  are  protected. 


We  reviewed  selected  vulnerability  assessments  completed  after  the 
Khobar  Towers  bombing  and  found  inconsistencies  in  frequency, 
approach,  and  quality. 
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•  Some  sites  have  had  numerous  assessments,  while  others  have  had  none. 
At  many  high-threat  sites,  numerous  assessments  had  been  conducted. 

One  site  in  Kuwait  had  been  assessed  at  least  nine  times  between  July 
1996  and  March  1997.  Officials  at  many  sites  we  visited  expressed  concern 
about  the  high  frequency  of,  and  lack  of  cohesion  among,  assessments. 
Conversely,  officials  at  some  component  commands  told  us  that 
vulnerability  assessments  had  never  been  conducted  at  sites  in  their  area 
of  responsibility.  In  the  absence  of  a  vulnerability  assessment, 
commanders  are  not  in  a  position  to  answer  the  question,  “How  vulnerable 
are  you  to  terrorist  attack?” 

•  Few  of  the  assessments  covered  all  the  minimum  functions  suggested  in 
DOD  guidance,  dod  suggests,  but  does  not  require,  that  at  a  minimum, 
vulnerability  assessments  address  four  areas:  (1)  weaknesses  in  physical 
security  plans,  programs,  and  structures;  (2)  inefficiencies  in  personnel 
practices  and  procedures  related  to  security  and  incident  control, 
response,  and  resolution;  (3)  enhancements  in  operational  procedures; 
and  (4)  resources  necessary  to  meet  security  requirements.  Many  of  the 
assessments  we  reviewed  addressed  physical  security,  but  few  addressed 
all  four  areas. 

•  Some  vulnerability  assessments  had  limited  value  because  they  did  not 
identify  specific  vulnerabilities.  For  example,  assessments  for  Air  Force 
and  Navy  sites  in  Panama  did  not  mention  specific  vulnerabilities,  making 
it  impossible  to  determine  what,  if  any,  improvements  were  needed  to 
decrease  their  vulnerabihty  to  terrorist  attacks.  These  assessments  instead 
gave  a  single  numerical  rating  of  vulnerability  based  on  a  number  of 
elements  such  as  location,  terrain,  and  access.  A  force  protection  official 
at  U.S.  Southern  Command  said  these  assessments  were  not  useful  for 
making  antiterrorism  decisions.  In  contrast.  Army  assessments  in  Panama 
were  very  detailed. 

•  Threat  information  was  not  well  defined.  According  to  dod  guidance,  a 
threat  analysis  provides  a  basis  for  assessing  the  terrorist  risk  to  a  given 
site,  including  the  likelihood  of  terrorist  attack  and  the  mode  of  attack.  It 
is  a  precursor  to  the  vulnerability  assessment.  However,  some  of  the 
assessments  we  reviewed  did  not  mention  the  threat  against  which  the  site 
needed  to  defend  itself  Others  vaguely  referred  to  the  terrorist  threat,  but 
lacked  specifics  on  the  mode  or  modes  of  attack  that  would  most  likely  be 
used.  Still  others  postulated  a  threat  that  appeared  incongruent  with  threat 
assumptions  made  elsewhere.  Most  notably,  an  assessment  conducted  for 
a  headquarters  building  in  the  United  States  postulated  a  truck  bomb 
threat  that  was  twice  the  size  of  the  bomb  dod  estimates  was  used  in  the 
Khobar  Towers  bombing. 
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We  also  found  that  some  commanders  believe  they  must  implement  all 
recommendations  contained  in  vulnerability  assessments.  While  the 
assessments  are  a  tool  to  help  commanders  identify  their  security 
weaknesses,  we  were  told  that  since  the  Khobar  Towers  bombing  some 
commanders  feel  they  must  implement  all  recommendations  from 
vulnerability  assessments,  whether  they  agree  with  them  or  not.  They  are 
taking  this  approach  out  of  fear  that  if  terrorists  attack  their  forces,  they 
could  be  criticized  for  failing  to  implement  a  recommended  corrective 
action  that,  in  hindsight,  would  have  mitigated  the  damage  from  the  attack. 

Vulnerability  assessments  lack  consistency  because  dod  has  not 
established  common  standards  for  them.  The  Downing  task  force 
criticized  the  current  approach  to  conducting  vulnerability  assessments, 
noting  that  dod  lacked  standards  governing  their  frequency,  format,  and 
content,  dod  has  acknowledged  that  vulnerability  assessments  vary  widely 
in  scope  and  comprehensiveness.  Further,  dod  has  acknowledged  that 
common  approaches  and  standards  are  needed,  but  it  does  not  plan  to 
impose  standards  that  would  apply  to  all  assessments,  jcs/j-34  officials  told 
us  this  was  not  their  role.  We  reviewed  dod’s  proposed  program  standards 
and  found  the  following  standards  regarding  vulnerability  assessments: 

“dod  Components  will  schedule  a  higher  headquarters  level  assessment  of 
their  installations  and  [Antiterrorism/Force  Protection]  Programs  at  least 
once  every  three  years.” 

“Commanders  will  prepare  a  terrorist  physical  security  vulnerability 
assessment  for  facilities,  installations,  and  operating  areas  within  their 
area  of  responsibility.  The  assessment  will  address  the  broad  range  of 
physical  threats  to  the  security  of  personnel  and  assets.” 

In  our  opinion,  these  standards  will  not  address  the  shortcomings  we 
identified  when  we  reviewed  the  vulnerability  assessments  because  they 
do  not  provide  specific  requirements  for  methodology,  scope,  and  content. 


DOD  Has  Not  Issued 
Prescriptive  Physical 
Security  Standards 


In  its  investigation  of  the  Khobar  Towers  bombing,  the  Downing  task  force 
found  that  dod  had  not  established  physical  security  standards,  including 
standards  governing  the  design  and  construction  of  new  buildings  or  the 
modification  of  existing  structures  against  the  terrorist  threat.  The 
Downing  task  force  recommended  that  dod  adopt  prescriptive  physical 
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security  standards.  We  found  that  dod  had  not  implemented  this 
recommendation  and  had  no  plans  to  do  so. 

The  Downing  task  force  held  up  the  State  Depautment’s  physical  security 
standards  as  an  example  for  dod  to  follow  in  developing  its  own  standards. 
The  task  force  characterized  the  standards  as  detailed  and  descriptive. 
Most  importantly,  the  task  force  stated,  State  had  adopted  the  standards  as 
requirements,  not  as  guidance.  State’s  standards,  developed  in 
coordination  with  the  Overseas  Security  Policy  Board,  apply  to  all  U.S. 
missions  abroad  under  the  authority  of  a  chief  of  mission.  The  standards 
were  created  primarily  for  U.S.  diplomatic  offices  and  residential  facilities. 
They  are  based  on  the  assessed  threat  level  in  the  coimtry,  with  the  result 
that  facilities  in  higher  threat  countries  must  meet  more  stringent 
requirements.  For  high-threat  areas,  the  standards  address  such  physical 
security  concerns  as  the  height  of  perimeter  walls,  entry  control,  stand-off 
distance,  and  the  location  of  parking  areas. 

Currently,  dod  requires  its  components  to  deploy  a  physical  security 
system  to  protect  defense  resources.  But,  unlike  at  State,  its  regulations  do 
not  establish  physical  security  standards  that  define  what  is  acceptable  or 
xmacceptable.  The  new  standards  developed  by  jcs/j-34,  noted  above,  also 
do  not  provide  detailed  and  descriptive  requirements.  The  standairds, 
rather,  are  considered  “performance  standards”  that  are  intended  to  lead 
commanders  through  an  assessment  of  their  antiterrorism  capabilities.  For 
instance,  one  standard  states,  “Commanders  wifi  develop  and  implement  a 
physical  security  plan,  as  part  of  the  [antiterrorism/force  protection] 
program,  that  incorporates  facilities,  equipment,  trained  personnel,  and 
procedirres  into  a  comprehensive  effort  designed  to  provide  maximum 
antiterrorism  protection  to  personnel  and  assets.”  More  specific  guidance 
to  implement  these  performance  standards  is  provided  in  a  dod  handbook, 
but  the  handbook  guidance  is  advisory  only.® 

JCS/j-34  officials  told  us  they  had  no  plans  to  issue  DOD-wide  physical 
secirrity  standards.  They  believe  that  the  variability  in  threat  and 
vulnerabilities  among  geographic  areas  and  individual  sites  precludes  such 
standards.  However,  we  noted  that  diplomatic  missions  also  face  different 
threats  and  vulnerabilities  yet  are  required  to  meet  State’s  physical 
security  standards.  The  jcs/j-34  officials  said  commanders  responsible  for 
antiterrorism  may  establish  standards  if  they  choose.  Of  the  five 
geographic  combatant  commands,  only  U.S.  Central  Command  had 


POD  0-2000. 12-H,  Protection  of  DOD  Personnel  and  Activities  Against  Acts  of  Terrorism  and  Political 
Turbulence,  dated  February  1993.  ~ 
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developed  prescriptive  design  standards.  Central  Command  officials  said 
that  since  dod  declined  to  issue  standards  for  protecting  facilities  against  a 
bomb  blast,  they  developed  their  own.  Officials  at  the  other  geographic 
combatant  commands  had  various  opinions  regarding  the  need  for 
DOD-wide  physical  security  standards.  For  instance,  U.S.  European 
Command  officials  stated  that  dod  should  establish  minimum  physical 
security  standards  for  each  threat  level  and  then  require  the  services  to 
publish  more  specific  guidance.  Such  an  approach  would  allow  for 
differences  among  the  services.  U.S.  Pacific  Command  officials  believe 
that  measurable  DOD-wide  physical  security  standards  are  a  good  idea  if 
they  provide  flexibility  to  allow  for  variability  in  the  threat  and  local 
circumstances.  U.S.  Navy  Europe  stated  that  there  is  an  absolute  need  for 
a  DOD-wide  standard  that  is  tough  enough  to  force  all  activities  to  a 
minimum  level  of  compliance  but  flexible  enough  to  allow  an  activity  to 
adjust  for  impediments  that  impact  its  ability  to  comply. 

In  its  report,  the  Downing  task  force  noted  that  commanders  are  currently 
left  to  a  subjective  determination  of  what  is  safe  and  unsafe.  With  the 
exception  of  the  U.S.  Central  Command,  we  confirmed  this  observation 
during  our  site  visits  and  came  across  instances  where  decisions  to  build 
facilities  in  the  absence  of  DOD-wide  physical  security  standards  had 
resulted  in  serious  security  lapses. 

•  Newly  completed  dormitories  in  one  country  we  visited  are  located  close 
to  a  heavily  traveled  public  road.  Base  officials  believe  that  the  road 
presents  a  vulnerability  to  truck  bombs  similar  to  the  bomb  that  exploded 
at  Khobar  Towers.  During  our  visit,  they  were  contemplating  closing  the 
road  or  building  a  tunnel  to  reroute  traffic  away  from  the  dormitories.  The 
installation  had  not  yet  begun  to  calculate  the  cost  of  these  measures. 

•  In  one  country,  a  new  $1.9  million  facility  was  being  built  on  a  city  street 
with  no  stand-off  distance.  The  geographic  combatant  command  assessed 
the  facility’s  vulnerabilities  during  construction  and  recommended  that  it 
be  relocated  to  a  more  secure  location.  Furthermore,  the  command  found 
that  with  one  exception,  none  of  the  off-base  facilities  it  visited  in  this 
country  conformed  with  the  advisory  guidelines  contained  in  dod’s 
antiterrorism  handbook. 

•  A  headquarters  building  under  construction  in  the  United  States  is 
considered  to  be  so  unsafe  that  a  service  assessment  team  suggested  that 
it  be  relocated.  The  additional  cost  to  improve  the  security  at  this  leased 
facility  is  estimated  to  be  about  $1  million  per  year. 
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Security  Threat  Conditions 
Are  Inconsistently  Applied 


DOD  has  established  a  system  of  terrorist  threat  conditions  to  indicate  the 
security  posture  at  its  sites.  All  dod  components  are  required  to  implement 
the  system.  One  objective  of  the  system  is  to  provide  a  common 
framework  to  facilitate  interservice  coordination.  The  geographic 
combatant  commanders  are  required  to  ensure  that  threat  conditions  are 
uniformly  implemented  in  their  area  of  responsibility.  Commanders  may 
choose  from  one  of  five  threat  conditions — Normal,  Alpha,  Bravo,  Charlie, 
and  Delta — depending  on  their  assessment  of  the  threat  and  other  factors 
such  as  target  vulnerability,  criticality  of  assets,  and  the  availability  of 
security  resources.  Threat  Condition  Normal  indicates  that  a  general 
threat  of  possible  terrorist  activity  exists  but  warrants  only  a  routine 
security  posture.  Threat  Condition  Delta,  on  the  other  hand,  applies  to  the 
immediate  area  where  a  terrorist  attack  has  occurred  or  when  intelligence 
has  been  received  that  terrorist  action  against  a  specific  location  is  likely. 
In  this  case,  commanders  are  required  to  implement  a  series  of  security 
measures.  The  other  threat  conditions  fall  between  Normal  and  Delta,  with 
each  one  having  associated  security  measures. 

The  Downing  task  force  noted  that  personnel  restrictions  based  on  threat 
conditions  varied  widely,  dod’s  guidance  states  that  the  threat  condition 
system  is  designed  to  provide  commanders  with  flexibility,  to  enable  them 
to  temper  actions  based  on  their  best  judgment  and  knowledge  of  the  local 
situation,  dod  officials  added  that  commanders  and  managers  must  take 
account  of  the  mission,  the  threat,  and  specific  circumstances,  all  of  which 
may  require  higher  levels  of  force  protection.  During  our  review,  however, 
we  foxmd  continued  inconsistencies  in  the  implementation  of  the  threat 
condition  system  that  did  not  appear  to  have  any  basis  in  mission,  threat, 
or  circumstance.  For  example: 

Some  commanders  in  the  Middle  East  implemented  markedly  different 
interpretations  of  the  security  measures  associated  with  Threat  Condition 
Charlie.  In  one  country,  for  instance,  personnel  from  one  service  were 
permitted  to  leave  the  base,  whereas  personnel  belonging  to  another 
service  at  two  nearby  bases  could  not.  In  a  second  coimtry,  personnel  at 
one  installation  were  generally  confined  to  the  installation  but  allowed  to 
make  limited  forays  to  an  off-base  civilian  housing  complex.  Personnel  at 
other  installations  in  this  coimtry  were  confined  to  their  bases  except  for 
mission-essential  travel. 

Even  within  the  same  base,  interpretations  of  Threat  Condition  Charlie 
could  be  inconsistent.  At  one  base,  personnel  under  one  combatant 
command  were  restricted  to  base  except  for  mission-essential  travel.  At 
this  same  base,  personnel  assigned  to  a  security  assistance  organization 
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were  permitted  to  go  to  restaurants  and  shopping  areas  downtown,  with 
no  clear  requirement  that  these  trips  be  mission  related.  These  same 
groups  also  implemented  markedly  different  controls  over  the  many  third 
country  workers  who  provide  cooking,  cleaning,  and  maintenance  services 
to  the  base.  The  combatant  command  required  escorts  for  their  workers 
while  the  security  assistance  organization  allowed  its  third  country 
workers  to  come  and  go  in  their  area  of  the  base  imescorted. 

•  Commanders  in  two  Middle  Eastern  countries  had  been  generally 
maintaining  the  intense  security  posture  associated  with  Threat  Condition 
Charlie  for  the  9  months  since  the  June  1996  Khobar  Towers  bombing, 
even  though  this  posture  was  supposed  to  be  used  only  for  short  durations 
in  response  to  imminent  terrorist  action.  The  extended  use  of  the 
measures  associated  with  this  threat  condition,  such  as  the  cancellation  of 
social  events;  the  placing  of  cafes,  theaters,  and  other  high-risk  areas  off 
limits;  and  the  increased  requirements  for  guard  personnel,  is  recognized 
as  likely  to  create  a  hardship  on  the  units  and  their  personnel.  Several  of 
the  commanders  we  visited  called  for  review  of  the  threat  condition 
system  in  light  of  the  current  security  environment. 

•  Differences  in  interpreting  threat  condition  measures  can  have  an 
operational  impact.  In  the  Middle  East  one  conunand  refused  to  allow  one 
of  its  transport  aircraft  to  land  because  a  disabled  aircraft  was  already  on 
the  ground.  The  command  believed  that  under  Threat  Condition  Charlie, 
two  of  its  aircraft  could  not  be  on  the  groimd  at  the  same  time  in  one 
location,  and  the  command  diverted  the  flight  to  Cairo,  Egypt.  However, 
the  local  commander  responsible  for  designating  the  threat  condition 
advised  us  that  he  would  have  allowed  the  aircraft  to  land. 

•  The  rationale  for  establishing  a  particular  threat  condition  was  not  always 
clear.  In  a  low-threat  country  for  instance,  one  base  had  established  Threat 
Condition  Normal,  whereas  an  abutting  base  belonging  to  another  service 
had  established  Threat  Condition  Bravo — ^two  levels  above  Normal. 
Officials  at  the  base  designated  as  Bravo  said  they  were  under  the 
impression  that  a  higher  headquarters  had  mandated  that  they  be  at  this 
threat  condition.  They  added  that  they  were  not  actually  implementing  the 
security  measures  associated  with  Bravo.  We  were  subsequently  informed 
that  the  threat  condition  at  this  base  would  be  lowered. 

•  The  security  forces  commander  at  one  base  in  Europe  said  he  did  not  have 
a  trained  and  ready  auxihary  force.  As  a  result,  if  the  threat  condition  were 
raised  to  Charlie,  his  forces  would  have  to  concentrate  their  efforts  on 
guarding  critical  assets  and  could  not  protect  office,  housing,  shopping, 
and  recreational  areas  where  personnel  congregate. 
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Antiterrorism 
Responsibility  for  Some 
Deployed  Personnel 
Remains  Unclear 


Antiterrorism  support  for  some  personnel  deployed  overseas  may  be 
inadequate  because  dod  has  not  ensured  that  responsibility  for  their 
security  is  clear.  The  Secretary  of  Defense  took  steps  following  the 
bombings  in  Saudi  Arabia  to  clarify  antiterrorism  responsibilities  for  dod 
elements  on  the  Arabian  peninsula,  dod  is  aware  that  similar  problems 
exist  in  other  countries,  but  it  has  largely  left  it  to  local  military  officials  to 
address  the  issue. 

As  noted  earlier,  dod  has  recently  assigned  the  five  geographic  combatant 
commanders  the  responsibility  for  ensuring  the  security  of  all  dod 
personnel  in  their  area  of  responsibility.  However,  approximately 
30,000  DOD  personnel  deployed  abroad  do  not  fall  under  the  command  of  a 
geographic  combatant  commander.  Some  of  these  personnel,  such  as 
those  assigned  to  a  Defense  Attache  Office  and  Marine  embassy  guards, 
fall  under  the  authority  of  a  chief  of  mission,  who  is  responsible  for  their 
security.  However,  many  others,  while  formally  under  the  authority  of  a 
chief  of  mission,  have  been  described  as  falling  into  a  gray  area  between 
the  force  protection  responsibility  of  the  geographic  combatant 
commander  and  the  chief  of  mission. 

The  U.S.  Ambassador  to  Turkey  and  the  Commander-in-Chief, 

U.S.  European  Command,  were  very  concerned  about  security  gaps  for 
gray-area  dod  persormel  in  that  high-threat  coimtry.  The  embassy,  working 
with  local  U.S.  military  representatives,  identified  nearly 
1,500  gray-area  personnel,  including  several  hundred  assigned  to  the  North 
Atlantic  Treaty  Organization  (nato).  Many  of  these  persormel  were 
receiving  little  or  no  security  support  from  the  embassy.  Such  support  can 
include  things  such  as  security  guards,  physical  security  assessments  of 
housing  and  work  places,  and  threat  information.  The  officials  said  that 
antiterrorism  responsibilities  for  these  personnel  must  be  clarified.  If  there 
is  a  question  about  dod’s  or  NATO’s  responsibility  for  any  of  these  gray-area 
persormel,  then  they  should  be  withdrawn  from  Turkey,  the  embassy  said. 
Alternatively,  if  the  embassy  is  to  be  given  responsibility  for  these 
personnel,  then  it  must  also  have  explicit  authority  over  them  to  enforce 
State’s  security  regulations.  Furthermore,  the  embassy  must  receive  a 
concomitant  increase  in  resources  to  cover  its  added  responsibilities. 
Missions  in  other  European  countries  have  raised  similar  concerns  about 
gray-area  dod  personnel.  These  missions  believe  they  should  be 
responsible  for  protecting  only  those  dod  personnel  accredited  to  the 
mission.  They  said  they  lack  the  resources  to  take  on  responsibility  for 
additional  dod  personnel. 
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Following  the  bombings  in  Saudi  Arabia,  dod  and  the  Department  of  State 
agreed  that  security  responsibilities  in  the  region  had  become  muddled. 
The  Secretary  of  Defense,  in  coordination  with  the  Secretary  of  State, 
decided  to  take  on  security  responsibility  for  most  dod  personnel  on  the 
peninsula.  Under  a  memorandum  of  understanding  between  the  two 
agencies,  U.S.  Central  Command  negotiated  with  each  chief  of  mission  to 
specifically  determine  which  dod  elements  will  fall  under  the  antiterrorism 
responsibility  of  the  combatant  commander  and  which  will  fall  under  the 
responsibility  of  the  mission. 

DOD  has  not  taken  such  a  comprehensive  approach  to  resolving  gray-area 
problems  outside  the  Arabian  peninsula.  Rather,  the  geographic 
combatant  commands  and  in-country  military  representatives  have  been 
working  with  the  missions  to  identify  gray-area  personnel  and  address 
security  issues  at  the  local  level.  Embassy  officials  in  Turkey  expressed 
frustration  with  this  approach.  They  believe  their  ability  to  address 
security  issues  is  limited  and  that  fundamental  policy  decisions  must  be 
addressed  at  high  levels  within  dod  and  the  State  Department.  For 
instance,  U.S.  officials  in  Turkey  will  not  be  able  to  unilaterally  order 
gray-area  dod  elements  to  modify  their  operations  for  security  purposes. 
Nor  can  they  resolve  resource  matters  on  their  own.  They  advocated  that  a 
memorandum  of  agreement  similar  to  that  for  the  Arabian  peninsula  be 
extended  to  other  countries.  Officials  at  other  embassies  said  a  more 
comprehensive  approach  is  needed.  For  instance,  embassy  and  military 
officials  in  Italy  said  there  is  no  mechanism  to  ensure  that  the  embassy  is 
informed  about  the  number  and  location  of  dod  personnel  in  coimtry. 

DOD  and  State  Department  officials  are  addressing  gray-area  issues  through 
a  joint  working  group  and  are  considering  establishing  a  memorandum  of 
understanding  that  would  apply  to  countries  outside  the  Arabian 
peninsula.  As  in  the  Arabian  peninsula,  such  a  memorandum  of 
understanding  would  require  implementation  agreements  between  each 
chief  of  mission  and  the  combatant  commander. 


Conclusions 


We  recognize  that  individual  commanders  are  responsible  for  ensuring  the 
protection  of  their  forces,  to  include  employing  appropriate  antiterrorism 
procedures.  Nevertheless,  we  believe  that  the  Department  of  Defense  has 
not  taken  the  steps  necessary  to  promote  a  comprehensive,  consistent 
approach  to  antiterrorism  that  will  give  commanders  at  all  levels  the  tools 
they  need  to  fulfill  their  antiterrorism  responsibilities.  A  lack  of 
prescriptive,  measurable  standards  leaves  commanders  without  an 
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objective  basis  for  determining  whether  their  antiterrorism  measures  are 
sufficient.  Moreover,  dod  lacks  assurance  that  the  antiterrorism  programs 
implemented  by  local  commanders  meet  a  consistent  minimum  standard 
for  aU  overseas  personnel. 


Recommendations 


We  recommend  the  Secretary  of  Defense  direct  the  Chairman  of  the  Joint 
Chiefs  of  Staff  to  develop  common  standards  and  procedures  to  include 

standardized  vulnerability  assessments  to  ensure  a  consistent  level  of 
quality  and  to  provide  a  capability  to  compare  the  results  from  different 
sites, 

DOD-wide  physical  security  standards  that  are  measurable  yet  provide  a 
means  for  deviations  when  required  by  local  circumstances,  and 
procedures  to  maintain  greater  consistency  among  commands  in  their 
implementation  of  threat  condition  security  measures. 

To  ensure  that  security  responsibility  for  dod  personnel  overseas  is  clear, 
we  recommend  that  the  Secretary  of  Defense  take  the  necessary  steps  to 
ensure  that  the  memorandum  of  understanding  now  imder  discussion  with 
the  Department  of  State  is  signed  expeditiously.  Further,  the  Secretary 
should  provide  the  geographic  combatant  commanders  with  the  guidance 
to  successfully  negotiate  implementation  agreements  with  chiefs  of 
mission. 


Agency  Comments 
and  Our  Evaluation 


In  commenting  on  a  draft  of  this  report,  dod  concurred  with  all  but  one  of 
the  recommendations.  It  did  not  concur  with  our  recommendation  for 
DOD-wide  physical  security  standards,  dod  disagreed  with  our  view  that 
JCS/j-34,  as  the  designated  antiterrorism  focal  point  within  dod,  should  take 
a  more  active  role  in  prescribing  common  standards.  Issuing  such 
standards  would  exceed  jcs/j-34’s  authority,  dod  asserted,  and  as  a 
Washington,  D.C.-based  office,  jcs/j-34  would  not  be  able  to  react  quickly 
enough  to  changes  in  terrorist  tactics.  In  addition,  dod  stated  that 
commanders  are  responsible  for  the  physical  security  of  their  personnel 
and  should  not  be  told  how  to  accomplish  this  task,  dod  believes  that  its 
proposed  combating  terrorism  “performance-based  standards,” 
supplemented  by  existing  physical  security  guidance,  wUl  be  sufficient  to 
assist  commanders.  Finally,  dod  stated  that  in  advocating  a  more  active 
focal  point,  we  had  misrepresented  the  spirit  and  intent  of  the  Downing 
Assessment  Task  Force. 
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We  continue  to  believe  that  common  dod  standards  would  aid 
commanders  by  providing  them  with  a  more  objective  basis  for 
determining  whether  their  forces  are  adequately  protected  from  terrorist 
threats.  Many  of  the  commanders  and  antiterrorism  officials  we  spoke 
with  specifically  noted  the  need  for,  and  the  importance  of,  DOD-wide 
standards.  The  most  obvious  source  of  common  dod  standards  is  Jcs/J-34 
because  it  is  the  designated  focal  point  within  the  Department.  As 
discussed  in  the  report,  we  recognize  that  it  is  the  Secretary  of  Defense 
who  formally  issues  dod  standards,  and  we  are  not  asking  that  jcs/j-34 
exceed  its  authority  as  a  staff  office.  However,  jcs/j-34,  through  the 
Chairman,  Joint  Chiefs  of  Staff,  has  been  given  the  mandate  to  take  an 
active  role  in  reviewing  and  recommending  changes  to  the  antiterrorism 
program.  It  should  take  full  advantage  of  this  role  by  advocating,  and 
leading  the  development  of,  common  standards.  If  dod  continues  to 
believe  that  jcs/j-34  is  not  the  appropriate  entity  to  develop  common 
standards,  then  the  Secretary  of  Defense  should  consider  assigning  this 
task  to  another  entity.  The  fundamental  point  remains;  DOD-wide  standards 
are  needed  to  assist  commanders  in  protecting  their  forces  from  terrorist 
attack. 

We  agree  with  dod  that  any  physical  security  standards  must  be  flexible  to 
accommodate  dod’s  unique  security  situations  and  have  included  this  in 
our  recommendation.  The  common  DOD  standards  could  be  supplemented 
as  needed  by  the  geographic  combatant  commands  and  their  service 
component  commands.  Similarly,  if  a  waiver  system  is  required,  it  could  be 
implemented  by  these  commands  rather  than  by  a  central  office  in 
Washington  such  as  jcs/j-34.  Moreover,  in  our  view  and  in  the  view  of 
several  commanders  we  spoke  with,  a  waiver  system  is  likely  to  add  a 
measure  of  accountability  to  the  program  and  ensures  that  senior-level 
officials  are  aware  of  potential  problems. 

We  disagree  that  we  have  misrepresented  the  spirit  and  intent  of  the 
Downing  Assessment  Task  Force  when  we  advocate  a  more  active  focal 
point.  In  conducting  our  review,  we  drew  extensively  from  the  task  force 
report,  and  we  believe  our  report  is  consistent  with  its  spirit  and  intent. 
While  DOD  is  correct  when  it  notes  that  the  task  force  report  stated  that  the 
single  DOD  element  should  not  become  a  substitute  for  commanders  at  all 
levels  applying  experience,  expertise,  and  resources  to  the  protection  of 
its  forces,  it  failed  to  note  the  task  force’s  opinion  that  the  lack  of  a  single 
element  in  dod  for  force  protection  had  an  adverse  impact  on  the  posture 
of  the  forces  in  the  field.  Throughout  its  report,  the  task  force  emphasized 


Page  21 


GAO/NSIAD-97-207  DOD’s  Antiterrorism  Program 


B-277464 


the  need  for  a  single  dod  element  responsible  for  force  protection. 
Specifically,  the  task  force  stated: 

“The  continued  threat  from  terrorism  strongly  argues  for  a  single  element  within  the  dod  to 
develop  policy  and  standards  for  force  protection,  to  act  as  an  advocate  for  greater  priority 
to  this  effort,  to  assist  commanders  in  developing  and  implementing  force  protection 
measures  at  overseas  sites,  and  to  manage  resources  on  both  a  routine  and  emergency 
basis.  This  agency  must  have  resources,  authority  to  act,  and  the  mandate  to  support 
directly  forces  challenged  by  terrorist  threats.” 


The  Secretary  of  Defense,  in  his  September  15, 1996,  report  to  the 
President  entitled  “The  Protection  of  U.S.  Forces  Deployed  Abroad,” 
stated: 

“General  Downing’s  report  correctly  recognizes  the  need  for  a  stronger  centralized 
approach  to  force  protection  within  dod.  There  indeed  should  be  a  single  individual 
designated  as  responsible  for  ensuring  that  our  policies  will  result  in  adequate  force 
protection  measures  being  taken  and  for  auditing  the  performance  of  our  units.” 

Moreover,  we  spoke  with  a  senior  member  of  the  Downing  Assessment 
Task  Force  regarding  the  role  of  a  single  entity,  and  he  confirmed  our 
interpretation.  He  also  confirmed  that  the  task  force  intended  that  dod 
adopt  physical  security  standards  that  were  specific,  directive  in  nature, 
and  applicable  across  the  Department. 

In  its  report,  the  task  force  repeatedly  emphasized  the  need  for  mandatory 
standards  (as  opposed  to  advisory  guidance)  regarding  physical  security. 
For  example,  it  recommended  that  the  Secretary  of  Defense  “establish 
prescriptive  dod  physical  security  standards”  and  “designate  a  single 
agency  within  dod  to  develop,  issue,  and  inspect  compliance  with  force 
protection  physical  security  standards.” 

The  following  are  examples  of  specific  observations  made  by  the  task 
force  regarding  prescriptive  physical  security  standards: 

“Because  neither  [dod  0-2000.  12~H]  nor  any  dod  directive  provides  formal  force  protection 
standards  with  which  the  service  components  must  comply,  commanders  are  left  to  a 
subjective  determination  of  what  is  safe  or  unsafe.  Unhke  the  Department  of  Defense,  the 
Department  of  State  has  mandated  physical  security  standards  ....  Regional  Security 
Officers  [at  U.S.  missions]  are  responsible  for  ensuring  compliance  with  the  [State] 
standards  which  are  detailed  and  descriptive.  They  rely  in  part  on  the  assessed  Threat 
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Level  in  the  country.  They  are  regularly  supplemented.  Most  importantly,  they  are 
recognized  as  requirements  by  the  Department  of  State.” 


“dod  0-2000.  12-H  provides  guidance  on  physical  security  for  U.S.-occupied  facilities.  It  does 
not  consider  the  structural  characteristics  of  buildings  to  be  protected.  It  does  not  define 
standards  for  design,  materials,  or  construction  of  new  buildings  or  modification  of 
existing  buildings  ....  Construction  and  modification  standards  are  required  to  ensure  that 
buildings  occupied  by  U.S.  forces  provide  appropriate  protection  in  the  specific  threat 
environment  in  each  country.  The  addition  of  Shatter  Resistant  Window  Film  is  listed  in 
[DOD  0-2000. 12-H]  as  a  suggested  measure  to  mitigate  the  effects  of  blast,  but  it  is  not 
required _ dod  must  address  the  significance  of  blast  effects  with  formal  standards.” 


“There  are  no  dod  standards  for  warning  systems.  This  was  a  significant  factor  that 
contributed  to  the  injuries  sustained  in  the  attack  on  Khobar  Towers  ....  Standards  must 
address  requirements  for  and  utility  of  warning  systems  in  a  range  of  potential 
environments.” 


In  its  comments,  dod  also  stated  that  our  report  uses  anecdotal  evidence 
and  represents  a  “snapshot”  of  a  program  that  has  undergone  dramatic 
changes  since  we  completed  our  fieldwork.  In  criticizing  the  use  of 
anecdotal  evidence,  dod  appears  to  be  referring  to  the  iUustrative 
examples  used  throughout  the  report.  We  believe  that  the  evidence  we 
gathered  during  the  course  of  our  work  was  reliable,  relevant,  and 
sufficient  to  support  our  findings,  conclusions,  and  recommendations.  We 
visited  approximately  30  overseas  bases  as  well  as  all  5  geographic 
combatant  commands  and  most  of  their  service  component  commands 
(see  app.  I).  During  these  visits  we  obtained  (1)  testimonial  evidence  firom 
designated  antiterrorism  officers  and  others,  (2)  documentary  evidence 
such  as  vulnerability  assessments  and  corrective  action  plans,  and 
(3)  physical  evidence  based  on  our  own  observations.  The  results  of  our 
work  are  based  on  the  totality  of  this  evidence  and  not,  as  dod  implies, 
primarily  on  anecdotes. 

With  respect  to  dod’s  comment  on  the  timeliness  of  our  review,  we 
recognize  in  the  report  that  dod’s  renewed  emphasis  on  antiterrorism  is 
only  about  a  year  old — dating  to  the  Khobar  Towers  bombing. 
Nevertheless,  we  beheve  that  the  report  accurately  reflects  the  current 
status  of  dod’s  antiterrorism  efforts  and  that  the  program  has  not  changed 
dramatically,  as  dod  states,  since  we  completed  our  field  visits  in  March 
and  April  1997.  When  we  asked  dod  officials  to  provide  evidence  of 
dramatic  changes  in  the  program,  they  stated  that  (1)  the  geographic 
combatant  commands  now  have  access  to  the  draft  combating  terrorism 


Page  23 


GAO/NSIAD-97-207  DOD*s  Antiterrorism  Program 


B-277464 


performance  standards;  (2)  the  Joint  Staff  and  the  Defense  Special 
Weapons  Agency  are  coordinating  their  vulnerability  assessments  with  the 
combatant  commands  and  the  services;  and  (3)  requests  submitted  to  the 
JCs/j-34-managed  combating  terrorism  fund  have  increased.  All  three  of 
these  initiatives  were  ongoing  during  our  review  and  do  not  bring  into 
question  the  currency  of  our  work. 

dod’s  comments  and  our  further  evaluation  of  them  are  presented  in 
appendix  11.  dod  also  provided  technical  comments  concerning  factual 
information  in  the  report,  and  we  have  modified  the  report  where 
appropriate. 


Our  scope  and  methodology  are  discussed  in  appendix  I. 

We  are  sending  copies  of  this  report  to  the  Secretaries  of  Defense,  the 
Army,  the  Air  Force,  and  the  Navy;  the  Chairman,  Joint  Chiefs  of  Staff;  the 
Corrunandant,  U.S.  Marine  Corps;  and  the  Secretary  of  State.  We  will  make 
copies  available  to  other  interested  parties  upon  request. 

The  major  contributors  to  this  report  were  Sharon  Cekala, 

Donald  L.  Patton,  Carole  Coffey,  John  Nelson,  Robert  Crowl,  and 
Thomas  Gosling.  If  you  or  your  staff  have  any  questions  concerning  this 
report,  please  call  me  on  (202)  512-5140. 


Mark  E.  Gebicke 
Director,  Military  Operations 
and  Capabilities  Issues 
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Representative  Ike  Skelton  and  the  Ranking  Minority  Member,  Senate 
Committee  on  Governmental  Affairs,  asked  that  we  review  the  Department 
of  Defense’s  (dod)  efforts  to  protect  U.S.  forces  from  terrorist  attacks.  In 
response  to  this  request,  we  reviewed  (1)  measures  taken  at  overseas  U.S. 
bases  to  enhance  the  security  of  deployed  personnel  and  (2)  recent  dod 
initiatives  to  improve  its  antiterrorism  program. 

For  our  review  of  antiterrorism  measures  taken  at  overseas  U.S.  bases,  we 
visited  the  five  geographic  combatant  commands,  many  of  their  service 
component  commands,  and  selected  overseas  sites  where  U.S.  forces  are 
deployed.  Most  of  the  sites  we  visited  were  in  countries  that  dod  considers 
to  be  a  high  threat  (Kuwait,  Saudi  Arabia,  and  Turkey)  or  a  medium  threat 
(Bahrain,^  Italy,  and  Qatar).  We  also  visited  sites  in  Panama  and  Germany, 
which  are  considered  low-threat  coimtries.  We  conducted  these  visits  in 
March  and  April  1997.  During  the  visits,  we  met  wdth  designated 
antiterrorism  officials  and  others  involved  in  the  program  to  discuss  the 
progress  that  had  been  made  in  identifying  and  addressing  vulnerabilities 
since  the  Khobar  Towers  bombing.  We  also  reviewed  pertinent 
documents,  such  as  vulnerabihty  assessments,  corrective  action  plans,  and 
records  pertaining  to  the  work  of  command  and  base  antiterrorism  teams. 
We  also  toured  the  installations  to  inspect  vulnerabilities.  In  addition,  we 
discussed  and  reviewed  documents  regarding  funding,  intelligence, 
training,  and  host  nation  relationships. 

The  geographic  combatant  commands  and  the  component  commands  we 
visited  were  as  follows: 

•  U.S.  Central  Command,  U.S.  Central  Command  Air  Forces,  U.S.  Navy 
Forces  Central  Command,  U.S.  Army  Forces  Central  Command. 

•  U.S.  European  Command,  U.S.  Army  Europe,  U.S.  Navy  Europe,  U.S.  Air 
Forces  in  Europe. 

•  U.S.  Southern  Command,  Special  Operations  Command  South,  U.S.  Army 
South. 

•  U.S.  Pacific  Command,  U.S.  Pacific  Air  Forces,  Commander-in-Chief 
Pacific  Fleet,  U.S.  Army  Pacific,  Marine  Forces  Pacific,  Special  Operations 
Command  Pacific. 

•  U.S.  Atlantic  Command,  Air  Combat  Command,  U.S.  Army  Forces 
Command. 


^Shortly  after  our  visit,  the  threat  level  in  Bahrain  was  changed  from  medium  to  high. 
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The  sites  we  visited,  by  country,  were  as  follows: 

Bahrain 

U.S.  Navy  Headquarters  and  Support  Compound 

Mina  Salman  pier  facilities 

Aviation  Unit,  Bahrain  International  Airport 

DOD  Dependents  School 

Mannai  Plsiza  Housing  Compound 

Germany 

Ramstein  Air  Base 

26th  Area  Support  Group,  U.S.  Army 

Italy 

Aviano  Air  Base 

Caserma  Ederle,  U.S.  Army 

Naval  Support  Activity  Naples 

Kuwait 

Ahmed  A1  Jaber  Air  Base 

Ali  A1  Salem  Air  Base 

Camp  Doha  Prepositioning  Site 

Aviation  Unit,  Kuwait  City  International  Airport 

Panama 

Howard  Air  Force  Base 

Fort  Clayton  Army  Base 

Naval  Station  (Rodman)  Panama  Canal 

Qatar 

"""""  Camp  Snoopy,  Qatar  International  Airport 

A1  Udeid  Air  Base  (under  construction) 

As  Sayliyah  Prepositioning  Site 

A1  Messilah  Housing  Compound 

Umm  Said  pier  facilities 

Saudi  Arabia 

Eskan  Village 

Prince  Sultan  Air  Base 

A1  Yamama  Housing  Compound 

Site  12 

Eagletown 
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U.S.  Military  Training  Mission  Detachment 
A1  Rakah  Housing  Compound 


Turkey 


Incirlik  Air  Base 

To  review  recent  dod  initiatives  to  improve  its  antiterrorism  program,  we 
interviewed  officials  and  obtained  information  from  the  Deputy 
Directorate  for  Combating  Terrorism,  Joint  Chiefs  of  Staff  (jcs/j-34);  the 
Office  for  Counterterrorism  Analysis,  Defense  Intelligence  Agency;  the 
Under  Secretary  of  Defense  (Comptroller);  the  Defense  Special  Weapons 
Agency;  the  Departments  of  the  Army,  the  Air  Force,  and  the  Navy; 
Headquarters,  U.S.  Marine  Corps;  and  the  geographic  combatant 
commanders  and  service  component  commands.  During  our  site  visits,  we 
discussed  the  impact  of  dod’s  initiatives  on  their  ability  to  protect  their 
forces,  including  the  problems  they  faced  in  implementing  their 
antiterrorism  responsibilities.  We  also  obtained  their  views  on  other 
initiatives  that  dod  could  undertake. 

In  addition,  we  reviewed  pertinent  dod  and  service  documents,  such  as 
directives,  regulations,  and  guidance  on  combating  terrorism  and  the 
reports  of  the  dod  Antiterrorism  Task  Force  and  the  Dovraing  Assessment 
Task  Force.  The  task  forces  were  created  to  recommend  improvements  to 
dod’s  antiterrorism  progrcim  following  the  two  terrorist  bombings  in  Saudi 
Arabia.  The  Downing  task  force  identified  key  principles  for  managing  and 
improving  the  Department’s  antiterrorism  program.  We  used  these  as  the 
primary  criteria  for  our  review. 

Because  the  Department  of  State  has  security  responsibilities  for  many 
dod  personnel  overseas,  we  met  with  the  Director  for  Overseas 
Operations,  Bureau  of  Diplomatic  Security;  the  U.S.  Ambassadors  to 
Kuwait,  Qatar,  and  Turkey;  and  the  Regional  Security  Officers  responsible 
for  Bahrain,  Great  Britain,  Italy,  Kuwait,  Panama,  Qatar,  Saudi  Arabia,  and 
Turkey.  We  obtained  their  views  on  the  missions’  ability  to  provide 
security  to  dod  personnel  and  on  the  probems,  if  any,  of  expanding  their 
security  responsibilities  to  additional  dod  personnel  overseas.  At  some  of 
these  missions,  we  also  met  with  dod  officials  who  fall  under  the  security 
responsibility  of  the  State  Department. 

We  conducted  our  review  between  October  1996  and  Jime  1997  in 
accordance  'with  generally  accepted  government  auditing  standards. 
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Note:  GAO  comments 
supplementing  those  in  the 
report  text  appear  at  the 
end  of  this  appendix. 


See  comment  1 . 


See  pp.  21  to  23. 


See  pp.  21  to  23. 


SPECIAL  OPERATIONS/ 
low-intensity  conflict 


THE  ASSISTANT  SECRETARY  OF  DEFENSE 
WASHINGTON.  D.C.  20301-2500 


June  30,  1997 


Mr.  Mark  E.  Gebicke 

Director,  Military  Operations  and  Capabilities  Issues 
National  Security  and  International  Affairs  Division 
U.  S.  General  Accounting  Office 
Washington,  D.  C.  20548 


Dear  Mr.  Gebicke: 


This  is  the  Department  of  Defense  (DoD)  response  to  the  General  Accounting  Office 
(GAO)  draft  report,  dated  June  9,  1997,  entitled  ‘*COMBA  ri  lNG  TERJIORISM:  Status  of  DoD 
Efforts  to  Protect  Its  Forces  Overseas,”  (GAO  Code  703174),  OSD  Case  1382-X.  The  draft 
report  reflects  an  expansive  research  and  reporting  effort  by  your  analysis  team. 

First  and  foremost  the  report  contains  specific  passages  which  contain  classified 
information.  The  information  is  of  a  serious  nature  in  that  it  discloses  vulnerabilities  of  specific 
Defense  installations  overseas  relating  to  national  security.  We  have  provided  specific  comments 
on  the  passages  in  the  enclosure. 

The  Department  concurs  with  comment  on  four  of  the  five  recommendations  in  the  report 
and  nonconcurs  with  one.  DoD  concurs  with  standardizing  vulnerability  assessments, 
maintaining  consistency  in  implementation  of  threat  condition  security  measures 
(THREATCONs),  taking  the  necessary  steps  to  ensure  that  the  memorandum  of  understanding 
now  under  discussion  with  the  Department  of  State  is  signed  expeditiously,  and  providing  the 
geographic  combatant  commander  with  the  guidance  to  successfully  negotiate  implementation 
agreements  with  chiefs  of  missions.  DoD  nonconcurs  with  issuing  prescriptive  physical  security 
standards  to  DoD  elements.  Our  performance  based  standards  provide  guidance  to  commanders 
and  rely  on  the  commander’s  leadership  to  balance  the  variables  of  mission,  threat,  risk,  and 
operating  environment  to  protect  our  personnel  and  resources.  Specific  comments  are  contained 
in  the  attached  enclosure,  which  also  addresses  the  GAO  findings  and  provides  comments  on 
inaccurate  factual  issues. 


We  do  not  believe  that  this  report  fiilly  reflects  the  importance  of  command  responsibility 
within  the  military.  Commanders  are  responsible  for  the  physical  security  of  their  personnel  and 
with  that  responsibility  must  go  broad-based  authority  and  flexibility  to  accomplish  the  task.  A 
commander  is  told  what  to  do  -  not  how  to  do  it.  Lastly,  the  report  misrepresents  the  spirit  and 
intent  of  the  Downing  Assessment  Task  Force  Report.  The  GAO  report  leaves  the  impression 
that  Downing  sought  a  “stronger  centralized. single  entity  approach  with  much  greater 
regulatory  authority  resident  within  the  Pentagon.  In  fact  Downing  said,  “The  DOD  element 
should  not  become  a  substitute  for  commanders  at  all  levels  applying  experience,  expertise,  and 
resources  to  the  protection  of  their  forces.  Force  protection  is  a  responsibility  of  command.” 
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See  pp.  23  and  24. 


While  the  report  is  a  thoughtful  review  of  the  DoD  Antiterrorisrn/Force  Protection 
(AT/FP)  program^  it  is  a  snapshot  using  anecdotal  evidence  of  an  eight  month  old,  r^idly 
evolving  program.  The  DoD  Combatting  Terrorism  program  has  changed  dramatically  since  the 
GAO  team’s  visit  and  will  change  even  more  in  the  next  year. 


Sincerely, 

H.  Allen  Holmes 

Enclosure: 

As  stated 
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See  pp.  21  to  23. 


See  comment  2. 


GENERAL  ACCOUNTING  OFFICE  DRAFT  REPORT  DATED  JUNE  9, 1997 
(GAO  CODE  703714)  OSD  CASE  1382 

“COMBATTING  TERRORISM:  STATUS  OF  DOD  EFFORTS  TO  PROTECT 
ITS  FORCES  OVERSEAS 

DEPARTMENT  OF  DEFENSE  COMMENTS 

FINDINGS 

FINDING  A:  “DOD  Needs  a  More  Active  Antiterrorism  Focal  Point  to  Provide  the 
Guidance  Commanders  Are  Requesting 

IX)D  RESPONSE:  After  the  Secretary  of  Defense  (SECDEF)  designated  the  Chairman 
as  his  principal  advisor  and  focal  point  on  antiterrorism,  the  Chairman  of  the  Joint  Chiefs 
of  Staff  (CJCS)  established  J-34  as  the  Joint  Staff  point  of  contact  for  combating 
terrorism.  In  turn,  J-34  has  developed  a  program  that  includes:  antiterrorism  security 
standards  (currently  in  the  approval  process);  an  ongoing  assessment  process  to  assist 
commanders  with  improving  antiterrorism  security  readiness;  Level  One  through  Level 
Four  Antitenrorism  training  (J-34  conducts  Level  4  training  for  senior  level  DOD 
executives);  the  Chairman’s  Combating  Terrorism  Readiness  Initiatives  Fund;  and 
assistance  to  field  commanders  on  antiterrorism  on  a  daily  basis.  GAO’s  perception  of 
the  DOD  combatting  terrorism  program  is  that  J-34  does  not  provide  centralized, 
prescriptive  guidance.  Title  10,  Section  155  states  that  “The  Joint  Staff  shall  not  operate 
...  as  an  overall  Armed  Forces  General  Staff  and  shall  have  no  executive  authority.”  US 
military  doctrine  is  to  provide  authoritative  general  guidance  at  the  strategic  level  and 
then  rely  upon  the  leadership  of  the  organizational  commanders  from  the  combatant 
commander  (CINC)  to  the  smallest  fighting  unit  to  execute  the  mission.  If  DOD  issued 
prescriptive  standards  from  a  centralized  bureaucracy,  then  prescriptive  measures  and 
tactics  would  be  the  result.  This  would  ensure  we  remain  one  step  behind  the  terrorists  as 
they  change  tactics  locally  while  we  try  to  react  in  Washington.  For  example.  State 
Department  standards,  which  took  two  years  to  coordinate,  do  not  provide  enough 
standoff  for  large  weapons  such  as  the  one  encountered  at  Khobar  Towers.  Building  131 
was  located  80  feet  from  the  center  of  the  crater  and  the  current  State  Department 
standard  is  65  feet  with  100  feet  preferred.  As  the  DOD  Combating  Terrorism  program 
matures,  the  leadership  of  trained  commanders  is  our  best  asset  against  this  form  of 
warfare.  SECDEF  and  CJCS  are  accomplishing  what  the  Downing  Report  intended  and 
executing  it  using  well-proven  organizations  and  doctrine. 


FINDING  B:  “Vulnerability  Assessments  Differ  in  Frequency,  Approach,  and 
Quality.” 

DOD  RESPONSE:  DOD  Directive  2000.12  (DODD  2000.12)  establishes  the  policy  that 
the  standards  contained  in  DOD  Instruction  2(XX).XX  (DODI  2(XX).XX)  shall  apply  to  all 
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See  pp.  21  to  23. 


See  comment  3. 


antiterrorism  force  protection  (AT/FP)  efforts  in  the  Department  of  Defense.  These 
standards  arc  used  when  conducting  assessments  by  all  DOD  components.  These 
standards  will  require  that  each  installation  be  reviewed  no  less  than  every  three  years, 
though  high  threat  areas  are  expected  to  receive  more  attention.  The  Joint  Staff 
Integrated  Vulnerability  Assessment  (JSIVA)  teams  use  2000.XX  and  CINC  standards  for 
each  joint  assessment  which  provides  uniform  results  regardless  of  whether  the  site  was 
temporary  or  permanent,  urban  or  remote.  Each  overseas  assessment  using  the  new  DOD 
standards  will  cover  all  aspects  of  the  installation  security  and  will  be  based  on  a  real 
threat  agreed  upon  between  Defense  Intelligence  Agency  (DIA),  the  CINC,  and 
installation  commander.  In  addition,  J-34  hosts  meetings  with  the  Services  and 
combatant  commands  to  discuss  assessment  methodology  and  standards  which  will  lead 
to  a  comnmn  approach.  J-34  also  inputs  the  results  of  the  JSIVA’s  into  the  Joint 
Universal  Lessons  Learned  (JULLS)  data  base  for  DOD-wide  use  to  provide 
standardization.  Individual  assessments  will  always  differ  somewhat  since  the  Services 
and  CINCs  tailor  their  assessments  to  address  individual  or  unique  force  protection 
requirements.  As  DOD  training  for  assessments  and  antiterrorism  in  general  is 
completed,  the  quality  of  assessments  will  continuously  improve. 

FINDING  C:  “DOD  Has  Not  Issued  Prescriptive  Physical  Security  Standards.” 

DOD  RESPONSE:  DOD  Directive  2000. 12  establishes  policy  that  DOD  Instruction 
2000.XX  contains  the  DOD  standards  that  shall  apply  to  all  AT/FP  efforts  in  the 
Department  of  Defense.  When  DOD  investigated  State  Department  standards,  we  found 
these  standards  inadequate  for  the  range  of  situations  found  in  DOD  including  urban, 
remote,  airfields,  ports,  ships,  and  temporary  field  conditions.  (Note:  State  Department 
issues  some  type  of  waiver  for  physical  standards  for  100  percent  of  its  embassies  with 
the  older  embassies  having  multiple  waivers.)  This  would  create  a  bureaucratic 
nightmare  tracking  each  individual  waiver  as  State  Department  currently  does.  Instead, 
DOD  chose  to  combine  performance-based  measures  and  procedures  with  tactics  and 
intelligence  to  combat  terrorism.  In  ^plying  these  standards,  commanders  and  managers 
must  balance  the  mission,  threat,  and  specific  circumstances,  all  of  which  may  require 
higher  levels  of  force  protection  or  deviations  from  a  prescriptive  standard.  DOD  cannot 
rebuild  or  modify  every  location  to  achieve  a  minimum  standoff.  As  a  source  of  physical 
numbers,  DOD  Directive  2000.12  states  that  “attention  shall  be  give  to  additional 
guidance  contained  in  DOD  5200.8-R,  and  MIL  Handbook  1013/1,  “Design  Guidelines 
for  Physical  Security”.  DOD  Directive  52(X).8  “Security  of  DOD  Installations  and 
Resources”  and  DOD  5200.8-R  “Physical  Security  Program  Regulations”  prescribe  DOD 
policies  and  minimum  standards  for  the  physical  protection  of  DOD  personnel, 
installations,  operations,  and  assets.  DOD  Handbook  0-2000. 12-H  contains  security 
guidance  to  amplify  DODD  52(X).8.  DOD  0-2000. 12-H  “Protection  of  DOD  Personnel 
and  Activities  Against  Acts  of  Terrorism  and  Political  Turbulence”  (dated  February  1993) 
provides  suggested  protective  measures  for  all  DOD  entities  worldwide.  Although 
contained  in  a  handbook  which  offers  general  guidance  versus  direction,  this  guidance 
combined  with  the  performance-based  standards  provide  commanders  the  knowledge  to 
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See  comment  4. 


ensure  a  high  level  of  protection.  As  the  standards  in  DODI  2000.XX  are  implemented, 
they  will  reduce  inconsistencies  and  direct  the  Services  and  CINCs  to  develop 
prescriptive  standards.  However,  differences  between  geographic  CINCs  and  Services 
arc  anticipated  as  force  protection  responses  must  be  based  on  the  terrorist  threat  which 
varies  worldwide. 

FINDING  D:  “Security  Threat  Conditions  Are  Inconsistently  Applied.” 

POD  RESPONSE:  DOD  Handbook  0-2000.12-H  provides  guidance  on  use  of  the  CJCS 
Threat  Condition  (THREATCON)  System.  When  establishing  the  THREATCON, 
commanders  and  managers  must  take  into  account  the  mission,  threat  and  specific 
circumstances  which  may  require  higher  levels  of  force  protection  or  which  may  justify 
deviations  from  the  standard.  This  is  the  case,  for  example,  in  Saudi  Arabia  where 
security  assistance  officials  must  leave  the  installation  to  conduct  the  mission  with  the 
Saudi  nndlitary.  On  the  other  hand,  Air  Force  personnel  have  no  need  to  leave  the 
installation  for  their  mission  and  the  commander  has  accordingly  restricted  them  to  the 
installation  for  their  safety.  The  DOD  terrorist  THREATCON  system  makes  provision 
for  subordinate  commanders  to  revise  THREATCONs  as  the  local  situation  dictates. 
Subordinate  commanders  may  raise  but  not  lower  the  THREATCON  established  by  his 
superior  in  the  chain  of  command.  This  may  lead  to  one  commander  creating  more 
security  than  the  commander  nearby,  but  this  flexibility  afforded  to  subordinate 
commanders  is  needed  to  balance  mission  and  risk  properly.  Uniform  implementation  of 
THREATCONs  is  one  of  the  CJCS  taskings  in  2(XX).12  and  J-34  continuously  reviews 
the  THREATCON  system  to  ensure  compliance  and  eliminate  inconsistencies. 

FINDING  E  “Antiterrorism  Responsibility  for  Some  Deployed  Personnel 
Remains  Unclear.” 

DOD  RESPONSE:  All  DOD  personnel  overseas  are  afforded  security  protection  by 
either  the  Chief  of  Mission  (COM)  or  Geographic  Combatant  Commander  (CINC).  In 
accordance  with  USC  Title  22,  Section  4802,  the  Secretary  of  State  is  responsible  for  the 
security  of  all  DOD  personnel  abroad  (DOD  noncombatant  elements)  other  than  those 
under  command  of  the  CINC  (DOD  combatant  elements).  The  1990  Memorandum  Of 
Understanding  (MOU)  between  Department  of  State  and  Department  of  Defense 
(DOS/DOD)  on  Overseas  Security  Support  implemented  procedures  and  defined 
responsibility  for  DOD  combatant  and  noncombatant  elements.  Noncombatant  elements 
arc  those  EX>D  personnel  and  organizations  not  assigned  to,  or  attached  to,  and  under  the 
command  of  a  combatant  commander  (geographic  CDSfC).  The  1990  MOU  continues  to 
serve  as  an  important  tool  in  defining  security  procedures  and  responsibilities  for  DOD 
noncombatant  elements  overseas.  USC  10  Section  162  provides  guidance  on  the 
assignment  of  military  forces  to  the  CINC.  Force  protection  and  security  of  these 
assigned  forces  is  inherent  in  a  commanders  (CINCs)  responsibility.  Utilizing  the  1996 
DOS/DOD  MOU  on  Security  on  the  Arabian  Peninsula  as  a  baseline  way  of  resolving 
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unclear  AT/FP  responsibilities,  DOD  and  DOS  are  in  the  process  of  drafting  a  new 
Memorandum  of  Understanding  which  would  be  applied  on  a  country-by-country  basis 
worldwide.  The  new  MOU  would  allow  the  transfer  of  force  protection  responsibility  to 
the  agency  which  can  best  provide  security  for  DOD  elements  currently  under  COM. 
Included  in  the  new  MOU  will  be  a  model  agreement  which  the  geographic  combatant 
commanders  will  use  to  help  them  in  their  negotiations  with  respective  COMs. 

Meanwhile,  DOD  has  provided  instructions  to  the  US  Defense  Representative  in  each 
country  to  provide  a  list  of  all  EKDD  elements  in  the  country  to  the  CINC  and  COM  to 
ensure  force  protection  responsibilities  are  clear.  This  effort  is  parallel  to  the  effort  by  the 
State  Department  in  each  country  to  identify  all  DOD  elements  and  ascertain  who  is 
providing  security  support. 

RECOMMENDATIONS 

RECOMMENDATION  1:  The  GAO  recommended  that  the  Secretary  of  Defense  direct 
the  Chairman  of  the  Joint  Chiefs  of  Staff  to  prescribe  and  ensure  the  use  of  conunon 
standards  and  procedures,  to  include: 

A.  standardized  vulnerability  assessments  to  ensure  a  consistent  level  of  quality  and  to 
provide  a  capability  to  compare  results  from  different  sites; 

B.  DOD-wide  physical  security  standards  that  are  measurable  yet  provide  a  means  for 
deviations  when  required  by  local  circumstances,  and 

C.  procedures  to  maintain  greater  consistency  among  commands  in  their  implementation 
of  threat  condition  security  measures, 

DOD  RESPONSE: 

l.A.  DOD  concurs  with  this  recommendation  and  is  developing  this  capability.  The 
Joint  Staff  is  providing  the  program  of  instruction  that  the  Defense  Special  Weapons 
Agency  is  using  to  train  the  JSIVA  teams  to  the  Services  and  combatant  commands. 
Additionally,  the  Services  and  combatant  commands  have  access  to  the  Joint  Universal 
Lessons  Learned  database  that  is  used  by  the  Joint  Staff  to  distribute  Force  Protection 
lessons  learned  from  the  JSIVA  visits.  The  Joint  Staff  is  coordinating  with  the  Services 
and  combatant  commands  to  consolidate  all  lessons  learned  regarding  Force  Protection 
into  one  database. 

LB.  DOD  nonconcurs  with  this  recommendation.  DOD  found  State  Department 
standards  inadequate  for  the  broad  range  of  situations  found  in  EXDD  including  urban, 
remote,  airfields,  ports,  ships,  and  temporary  field  conditions.  Additionally,  the 
Department  seeks  to  avoid  a  bureaucratic  regime  of  waivers  which  must  be  tracked  and 
managed.  As  discussed  earlier,  DOD  standards  are  "mission  oriented”  types  of  standards. 
The  concept  relies  on  commanders  to  establish  prescriptive  standards  for  each  area  of 
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responsibility  (AOR)  that  balance  the  variables  of  threat,  geography,  mission,  and  risk  to 
protect  our  most  valuable  resource,  our  people.  This  concept  is  inherent  in  command  and 
centralized  metric  standards  similar  to  those  used  by  State,  will  not  replace  leadership, 

l.C.  DOD  partially  concurs  and  provides  additional  comments  as  follows.  DOD 
standards  will  address  the  use  of  THREATCONs  which  JSIVA  teams  will  address  during 
assessment  visits.  In  addition,  the  Joint  Staff  will  include  discussion  of  THREATCONs 
in  its  upcoming  quarterly  symposium  and  quarterly  message  to  the  field.  The  Department 
of  Defense  does  not  intend,  however,  to  limit  the  commander’s  prerogative  to  establish 
security  conditions  for  his  unit. 

RECOMMENDATION  2:  To  ensure  that  security  responsibility  for  DOD  personnel 
overseas  is  clear,  the  GAO  also  recommended  the  Secretary  of  Defense  take  the  necessary 
steps  to  ensure  that  the  memorandum  of  understanding  now  under  discussion  with  the 
Eyepartment  of  State  is  signed  expeditiously. 

E>OD  RESPONSE:  DOD  concurs  with  this  recommendation.  DOD  representatives  have 
been  meeting  with  representatives  from  State  on  a  bi-weekly  basis  since  October  1996 
and  for  the  past  month  have  met  weekly  to  complete  the  MOU. 

RECOMMENDATTON  The  GAO  further  recommends  that  the  Secretary  of  Defense 
provide  the  geographic  combatant  commander  with  the  guidance  to  successfully  negotiate 
implementation  agreements  with  chiefs  of  missions. 

DOD  RESPONSE:  DOD  concurs  with  this  recommendation.  As  stated  above,  included 
in  the  new  MOU  being  drafted  by  DOD  and  DOS  representatives  is  a  model  agreement 
which  the  geographic  combatant  commanders  will  use  to  help  them  in  their  negotiations 
with  respective  COMs.  Meanwhile,  DOD  has  provided  instructions  to  the  US  Defense 
Representative  in  each  country  to  provide  a  list  of  all  DOD  elements  in  the  country  to  the 
CINC  to  ensure  force  protection  responsibilities  are  clear.  This  effort  is  parallel  to  the 
effort  by  the  State  Department  in  each  country  to  identify  all  DOD  elements  and  ascertain 
who  is  providing  security  support. 
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The  following  is  our  response  to  dod’s  letter  dated  June  30,  1997. 


GAO  Comments 


1.  We  met  with  dod  officials  to  review  their  concerns  and  deleted 
references  to  specific  locations,  dod  officials  approved  these  changes. 
These  changes  do  not  affect  the  message  of  our  report. 

2.  In  our  view,  using  the  standards  in  dod  Instruction  2000.XX  will  not 
resolve  the  vulnerability  assessment  problems  we  noted  during  our 
review.  First,  the  standards  are  performance  standards,  not  physical 
security  standards.  Because  these  performance  standards  focus  on 
policies,  procedures,  and  plans  rather  than  physical  security,  it  is  not  clear 
how  they  can  be  used  to  identify  physical  security  vulnerabilities.  The 
inability  to  identify  specific  vulnerabilities  was  a  problem  we  noted  with 
some  of  the  assessments  we  reviewed.  Second,  because  the  standards  are 
not  detailed  and  descriptive,  they  are  subject  to  interpretation  by  the  many 
different  agencies  and  individuals  who  conduct  vulnerability  assessments. 
In  the  absence  of  more  specific,  measurable  standards,  the  fundamental 
issues  of  methodology,  scope,  and  completeness  discussed  in  our  report 
will  remain. 

Also,  as  of  early  July  1997,  dod  had  not  issued  dod  Instruction  2000.XX. 

DOD  officials  said  they  could  not  estimate  when  the  instruction  would  be 
issued.  In  addition,  at  the  time  we  completed  our  fieldwork,  only  the 
Central  Command  had  established  its  own  standards,  a  key  component  of 
the  assessment  process  according  to  dod. 

3.  As  DOD  acknowledges  in  its  comments,  this  guidance  is  advisory  in 
nature.  Furthermore,  the  Downing  Assessment  Task  Force  found  that 
many  conunanders  in  the  field  were  not  aware  of  this  guidance  and,  thus, 
were  not  using  it. 

4.  Our  recommendation  does  not  encourage  dod  to  limit  the  commander’s 
prerogative  to  establish  the  threat  condition  security  measures  for  his  or 
her  unit,  but  we  would  encourage  the  Department  to  take  the  necessary 
steps  to  ensure  that  these  measures  are  based  on  a  realistic  assessment  of 
the  mission,  the  threat,  and  the  specific  circumstances  of  the  local 
situation.  During  our  review  we  noted  inconsistencies  in  the  threat 
condition  system  that  did  not  appear  to  be  based  on  these  factors.  For 
example,  in  the  instance  cited  by  dod  in  its  comments,  the  security 
assistance  personnel  are  permitted  to  leave  the  base  for 
nonmission-related  activities,  such  as  shopping  and  eating  at  restaurants. 
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5.  The  steps  dod  is  taking  should  promote  greater  consistency  in  how 
vulnerabihty  assessments  are  conducted.  However,  in  the  absence  of 
formal  dod  standards,  the  combatant  commands  and  services  may  still 
choose  to  deviate  from  the  program  of  instruction  used  by  the  Joint 
Service  Integrated  Vulnerability  Assessment  teams.  Therefore,  we 
continue  to  believe  that  common  standards  and  procedures  for  conducting 
vulnerability  assessments  are  needed  to  ensure  a  consistent  level  of  quality 
and  to  provide  a  capability  to  compare  results  from  different  sites. 

6.  Neither  dod  Directive  2000.12  nor  dod  Instruction  2000.XX  requires  that 
commanders  establish  prescriptive  physical  security  standards  for  each 
area  of  responsibility.  As  we  noted  in  comment  2,  only  the  Central 
Command  has  estabUshed  prescriptive  standards. 

7.  As  of  early  July  1997,  the  memorandum  of  understanding  had  not  been 
signed,  dod  officials  said  they  could  not  estimate  when  it  would  be  signed. 

8.  As  discussed  in  our  report,  the  memorandum  of  imderstanding  and 
accompanying  agreements  should  address  (1)  the  authority  of  a  chief  of 
mission  to  direct  dod  entities  to  comply  with  State  security  standards  and 
(2)  the  resources  of  the  mission  to  fulfill  its  security  responsibilities  with 
respect  to  dod  personnel,  dod  does  not  address  these  concerns  in  its 
comments. 
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